=====================================================================
EPIC
___________
Electronic
Privacy
Information
Center
Report 94-1
Privacy Guidelines for
the National Information Infrastructure
A Review of the Proposed Principles
of the Privacy Working Group
TABLE OF CONTENTS
_______________________________________
- Summary
- Issue
- Background
Privacy Working Group
Development of Principles
Code of Fair Information Principles
NII and Privacy
- Proposed Privacy Principles (Complete text)
Preamble
General Principles for the NII
Principles for Information Collectors
Principles for Information Users
Principles for Individuals
- First Impressions
- Assessment
Need for Codes of Fair Information Practices
1973 HEW Code
1980 OECD Guidelines
Draft Privacy Principles
- Proposed Change for the Privacy Principles
- Further Information
- Bibliography
- About EPIC
SUMMARY
_______________________________________
* The Privacy Working Group of the Information Infrastructure Task
Force has proposed a draft privacy code for the National
Information Infrastructure.
* "Codes of Fair Information Practice" are a foundation for future
privacy policies. A 1973 code provided the basis for the Privacy
Act of 1974, a landmark privacy law. A 1980 international code
led to the adoption of privacy laws in 20 countries.
* Strong privacy codes for network communications have recently
been adopted in New York state, Canada, and Japan.
* The principles proposed by the Privacy Working Group are weaker
than the current codes and leave large gaps in NII privacy policy
in such areas as encryption, informed consent, unique
identifiers, and enforcement.
* The proposed code is also inadequate for the purpose of promoting
international data flows, and may limit the ability of users in
the United States to exchange data with users in other countries.
* Unless a stronger code is developed, there will be inadequate
privacy protection for future users of the National Information
Infrastructure
* Comments on the proposal are due to the Privacy Working Group by
June 23, 1994. The IITF Gopher/Bulletin Board can be accessed at
iitf.doc.gov. Electronic comments may be sent to nii@ntia.doc.gov
ISSUE
_______________________________________
The Privacy Working Group of the Information Infrastructure Task
Force (IITF) released draft "Principles for Providing and Using
Personal Information" on May 4, 1994. This is a set of principles
for the collection and use of personal information. The Code could
play an important role setting out the responsibilities of
organizations that collect personal information and providing
privacy protection for NII users.
BACKGROUND
_______________________________________
= = = = = = = = = = = = = = = = = = = =
To ensure individual privacy, existing laws, practices and
policies must be examined and adapted to the new environment.
Workplan of the Privacy Working Group
= = = = = = = = = = = = = = = = = = = =
Privacy Working Group
The Privacy Working Group is one of the advisory groups
created by the Information Infrastructure Task Force. The IITF is
an inter- governmental organization charged with the coordination
of government policy for the Information Infrastructure. The IITF
is chaired by Vice President Al Gore and Secretary of Commerce Ron
Brown. The IITF Secretariat is NTIA Administrator Larry Irving.
There are three IITF Committees -- Information Policy,
Applications, and Telecommunications Policy. The Privacy Working
Group is one of three working groups within the Information Policy
Committee. The other two are Information Access and Intellectual
Property.
The Privacy Working Group is made up of about twenty federal
officials from such agencies as the Department of Justice, the
National Security Agency, the Commerce Department, the Defense
Department, the Office of Management and Budget, IRS, Census, the
US Postal Service and other agencies. The Working Group was
originally chaired by Patricia Faley, then acting director of the
US Office of Consumer Affairs. Ms. Faley has since been succeeded
by Rob Veeder of the Office of Information and Regulatory Affairs
at the OMB. The Privacy Working Group reports to Sally Katzen who
is the administrator for the Office of Information and Regulatory
Affairs and the Chair of the IITF Committee on Information Policy.
According to the Workplan of the Privacy Group, there are
several priority issues including "Putting Protection Around a
Moving Target," "Providing Security for Sensitive Data, and
defining policies for use of personal data and personal
identifiers, developing legislation, assigning responsibility for
privacy protection and public education. The Privacy Working Group
also identified seven possible milestones:
1) Identification of scope of privacy concerns
2) Development of a statement of Fair Information Practices
3) Determination of who should have responsibility for
implementing practices
4) Identification of gaps in current U.S. law
5) Identification of control mechanisms for privacy protection
6) Preparation of paper with recommendations
7) Drafting of proposed legislation.
= = = = = = = = = = = = = = = = = = = =
* Financial services
* Direct Marketing
* Research records
* Law enforcement
* Information technology
* Public records
* Telecommunications
Agenda for Working Group meeting on Privacy and the NII
= = = = = = = = = = = = = = = = = = = =
Development of Principles
During the past year the Privacy Working Group invited
interested parties to provide briefings to the group on privacy
issues. Privacy experts, industry representatives and government
officials all met with members of the working group and made
various recommendations for privacy protection and the NII. There
was a wide range of opinions on several topics. Privacy experts
generally argued for stronger privacy protections, industry
representatives said that self-regulation was adequate and new laws
unnecessary. There were also some areas of agreement. Many of
those who spoke with the Working Group mentioned the public
opposition to the Clipper encryption proposal, the need to develop
a privacy agency, and the need to create new information practices
for the Information Infrastructure. There were no formal
announcements of these meetings or a published report.
The Privacy Working Group also held several days of public
hearings. In January 1994 two days of hearings were held in
Washington, DC and two days in Sacramento California. Topics
covered at the public hearings on "Privacy and the National
Information Infrastructure" included financial services, direct
marketing, research records, law enforcement, information
technology, public records, and telecommunications. Participants
were asked to identify the most critical privacy concerns for their
organizations, to make specific recommendations to accommodate
those concerns, and to provide recommendations for legislation,
regulation, standards, or voluntary compliance. There was again no
formal published report as a result of these hearings.
The proposed privacy principles for the information
infrastructure is the first recommendation from the Privacy Working
Group. The privacy working group is also exploring other privacy
issues including the creation of a privacy agency, identifying gaps
in current U.S. law, identifying control mechanisms for privacy
protection, and preparing a paper recommending proposals for
actions, policies, and legislation to protect the privacy of
individuals.
Code of Fair Information Practices
The principles developed by the Privacy Working Group follow
the general format of a "Code of Fair Information Practices." Such
a Code is a well known approach to develop privacy policies. The
purpose is to outline general principles and to make clear the
responsibility of organizations that collect personal information
to protect the interests of the public. A Code developed in 1973
by a special government committee led to the development of the
Privacy Act of 1974, a landmark privacy law. Another code
developed in 1980 by the Organization for Economic Cooperation an
Development, an international organization in Paris, later became
the basis of privacy laws in almost two dozen countries.
= = = = = = = = = = = = = = = = = = = =
"The effective protection of personal data and privacy is
developing into an essential precondition for social
acceptance of the new digital networks and services."
European Commission
= = = = = = = = = = = = = = = = = = = =
NII and Privacy
During the period that the Privacy Working Group met with
experts to discuss privacy issues and held public hearings, several
new privacy issues regarding the information infrastructure
emerged. In February, 1994 the White House announced support for
the Clipper cryptography proposal. The White House also indicated
support for the FBI's Digital Telephony proposal. Both proposals
are controversial. A Time/CNN poll found 80% of the American public
opposed to Clipper.
Several legislative proposals were also under consideration in
Congress. One would establish fair information practices for
medical records. A second would limit the collection and use of
CPNI, Customer Proprietary Network Information. Another would
establish privacy safeguards for employees in the workplace. A
fourth would protect the privacy of drivers' records. Perhaps the
most significant legislative proposal was for the creation of a
privacy agency, similar to those in other countries.
Within the federal agencies there were also several proposals
under consideration with significant privacy implications. The IRS
was developing a system for electronic tax filing. The Postal
Service was considering the establishment of a national
identification card.
PROPOSED PRIVACY PRINCIPLES
_______________________________________
The "Principles for Providing and Using Personal Information"
recommend by the Privacy Working Group begin as follows:
The United States is committed to building a National
Information Infrastructure (NII) to meet the information needs of
its citizens. This infrastructure, essentially created by advances
in technology, is expanding the level of interactively, enhancing
communication, and allowing easier access to services. As a result,
many more users are discovering new, previously unimagined uses for
personal information. In this environment, we are challenged to
develop new principles to guide participants in the NII in the fair
use of personal information.
Traditional fair information practices, developed in the age of
paper records, must be adapted to this new environment where
information and communications are sent and received over networks
on which users have very different capabilities, objectives and
perspectives. Specifically, new principles must acknowledge that
all members of our society (government, industry, and individual
citizens), share responsibility for ensuring the fair treatment of
individuals in the use of personal information, whether in paper or
electronic form. Moreover, the principles should recognize that
the interactive nature of the NII will empower individuals to
participate in protecting information about themselves. The new
principles should also make it clear that this is an active
responsibility requiring openness about the process, a commitment
to fairness and accountability, and continued attention to
security. Finally, principles must recognize the need to educate
all participants about the new information infrastructure and how
it will affect their lives.
These "Principles for Providing and Using Personal Information"
recognize the changing roles of government and industry in
information collection and use. Thus they are intended to be
equally applicable to public and private entities that collect and
use personal information. However, these Principles are not
intended to address all information uses and protection concerns
for each segment of the economy or function of government. Rather,
they should provide the framework from which specialized principles
can be developed.
= = = = = = = = = = = = = = = = = = = =
Factors contributing to the growth of public concern about
communications privacy:
(1) growth of electronic transactions
(2) accelerated collection of personal information
(3) increase in number of communication service provider
(4) growing use of unsecured communication channels such as
mobile phones.
New York Public Service Commission
= = = = = = = = = = = = = = = = = = = =
These are the draft principles developed by the Privacy Working
Group.
I. General Principles for the National Information Infrastructure
A. Information Privacy Principle
1. Individuals are entitled to a reasonable expectation of
information privacy.
B. Information Integrity Principles
Participants in the NII rely upon the integrity of the
information it contains. It is therefore the responsibility of all
participants to ensure that integrity. In particular, participants
in the NII should, to the extent reasonable:
1. Ensure that information is secure, using whatever means
are appropriate;
II. Principle for Information Collectors (i.e. entities that
collect personal information directly from the individual)
A. Collection Principle
Before individuals make a decision to provide personal
information, they need to know how it is intended to be used, how
it will be protected, and what will happen if they provide or
withhold the information. Therefore, collectors of this information
should:
1. Tell the individual why they are collecting the
information, what they expect it will be used for, what steps they
will take to protect its confidentiality and integrity, the
consequences of providing or withholding information, and any
rights of redress.
III. Principles for Information Users (i.e. Information Collectors
and entities that obtain, process, send or store personal
information)
A. Acquisition and Use Principles
Users of personal information must recognize and respect the
stake individuals have in the use of personal information.
Therefore, users of personal information should:
1. Assess the impact on personal privacy of current or
planned activities before obtaining or using personal information;
2. Obtain and keep only information that could reasonably be
expected to support current or planned activities and use the
information only for those or compatible purposes;
3. Assure that personal information is as accurate, timely,
complete and relevant as necessary for the intended use;
B. Protection Principle
Users of personal information must take reasonable steps to
prevent the information they have from being disclosed or altered
improperly. Such users should:
1. Use appropriate managerial and technical controls to
protect the confidentiality and integrity of personal information.
C. Education Principle
The full effect of the NII on both data use and personal
privacy is not readily apparent, and individuals may not recognize
how their lives can be affected by networked information.
Therefore, information users should:
1. Educate themselves, their employees, and the public about
how personal information is obtained, sent, stored and protected,
and how these activities affect others.
2. Ensure that information is accurate, timely, complete, and
relevant for the purpose for which it is given. D. Fairness
Principles Because information is used to make decisions that
affect individuals, those decisions should be fair. Information
users should, as appropriate:
1. Provide individuals a reasonable means to obtain, review,
and correct their own information;
2. Inform individuals about any final actions taken against
them and provide individuals with means to redress harm
resulting from improper use of personal information;
3. Allow individuals to limit the use of their personal
information if the intended use is incompatible with the original
purpose for which it was collected, unless that use is authorized
by law.
IV. Principles for Individuals who Provide Personal Information
A. Awareness Principles
While information collectors have a responsibility to tell
individuals why they want information about them, individuals also
have a responsibility to understand the consequences of providing
personal information to others. Therefore, individuals should
obtain adequate, relevant information about:
1. Planned primary and secondary uses of the information;
2. Any efforts that will be made to protect the
confidentiality and integrity of the information;
3. Consequences for the individual of providing or
withholding information;
4. Any rights of redress the individual has if harmed by
improper use of the information.
B. Redress Principles
Individuals should be protected from harm resulting from
inaccurate or improperly used personal information. Therefore,
individuals should, as appropriate:
1. Be given means to obtain their information and be provided
opportunity to correct inaccurate information that could harm them;
2. Be informed of any final actions taken against them and
what information was used as a basis for the decision;
3. Have a means of redress if harmed by an improper use of
their personal information.
A commentary with 40 numbered paragraphs follow.
FIRST IMPRESSIONS
_______________________________________
= = = = = = = = = = = = = = = = = = = =
Surveillance, carried out for whatever presumed benevolent
purpose, has the potential to hinder our liberty and erode
democracy.
Hon. David Flaherty
= = = = = = = = = = = = = = = = = = = =
The Working Group chose an appropriate privacy topic to address
first. Updating the Code of Fair Information Practices is an
important project. The original 1973 Code could be adapted for
network communications. This would require giving individuals
enforceable rights, controlling the sale of personal data,
strengthening consent mechanisms, and incorporating new principles
that recognize recent developments in technology such as the use of
cryptography in commercial networks.
Instead, the Privacy Working Group developed a code that is
actually weaker than the 1973 guidelines and far weaker than recent
proposals developed in New York state, Canada and Japan. The basic
premise of Fair Information Practices is that organizations have
responsibilities to protect data and that individuals have rights
when data is improperly used. The Privacy Working Group shifts the
responsibility for privacy protection from organizations to
individuals. This is a surprising recommendation that ignores the
fact that it is organizations that are currently developing the
policies and practices for data collection in the information
infrastructure.
The working group also assumed mistakenly that the 1973 Code
did not cover the private sector, which it does. Indeed the 1980
OECD Guidelines, a similar code of Fair Information Practices based
on the 1973 Code, has already been endorsed by 140 US companies.
Finally, the important new privacy issues brought about the
NII -- the use of cryptography, the collection of transactional
data, the use of unique identifiers, the sale of personal records,
the creation of on- line mailing lists -- are not addressed in the
proposed code. For example, the principle in the 1970s that
individuals have a right to inspect personal information and
determine accuracy could have been updated, given recent growth of
network technologies, to require organizations such as credit
agencies and insurance companies to make available to individuals
each year a complete record of personal information held.
The Privacy Working Group also did not address many of the most
pressing privacy concerns, particularly the Clipper proposal or the
sale of consumer data. This is significant because while the
Working Group was developing the privacy principles, the White
House decided to move forward with the Clipper proposal.
ASSESSMENT
_______________________________________
Need for Codes of Fair Information Practices
A Code of fair Information Practices is a good starting point
for privacy policy. Such codes help clarify the responsibilities
of organizations that collect personal information and provide
basic safeguards for individuals. The codes are typically
non-technical, and non-legalistic and allow the development of
national laws and voluntary policies. In the last few years
several states in the US and many foreign governments have
developed such codes to address the privacy issues created by new
communications technologies. Perhaps the most important state code
was developed by Professor Eli Noam when he served as chair of the
New York Public Service Commission. Notable codes were also
developed in Japan for the Ministry of Post and Telecommunication
by Professor Masao Horibe and in Canada by Professor David
Flaherty.
The most important Code of Fair Information Practices in the
United States was developed in 1973 by a special committee at the
Department of Health, Education, and Welfare charged with
developing privacy safeguards for automated information systems.
The group was chaired by Willis Ware and published a widely cited
report Records, Computer, and the Rights of Citizens. The report
is often credited with providing the foundation for the Privacy Act
of 1974.
The 1973 Code of Fair Information Practices is often mentioned
in privacy literature. Various capsulations of the Code are
frequently cited. It is important to look at the original HEW
report to understand the full force of the recommendations. The
1973 Advisory Committees recommended the "enactment of legislation
establishing a Code of Fair Information practices for all automated
personal data systems. It said also :
* The code should define "fair information practice" as adherence
to specified safeguard requirements.
* The Code should prohibit violation of any safeguard requirement
as an unfair information practice.
* The Code should provide that an unfair information practice be
subject to both civil and criminal penalties.
* The Code should provide for injunction to prevent violation of
any safeguard requirement.
* The Code should also give individuals the right to bring suits
for information practices to recover actual, liquidated, and
punitive damages in individual or class action.
The 1973 Code set out a proposed code subdivided into three
categories -- General Requirements, Public Notice Requirements, and
Rights of Individual Data Subjects. General Requirements focused
on the responsibilities of organizations maintaining individually
identifiable personally data to safeguard the information and to
restrict transfer without prior informed consent. The Public
Notice section described the obligation of an organization to make
known to the public existence of such record-keeping systems. The
section on Rights of Individual Data Subjects described a range of
rights of individual subjects including the right to be informed of
data collection, to correct errors, and to limit dissemination of
personal information.
The 1973 Code set out clear responsibilities for data
collectors and clear rights for data subjects. It argued that
enforcement of the principles was necessary and that rights should
be backed up by criminal penalties.
Codes of Fair Information Practices can also be found in
international agreements. The best known is the "Guidelines
Governing the Protection of Privacy and Transborder Flows of
Personal Data" developed by the Organization for Economic
Cooperation and Development in 1980. The Basic Guidelines are
these:
Collection Limitation Principle There should be limits to the
collection of personal data and any such data should be obtained by
lawful and fair means and, where appropriate, with the knowledge or
consent of the data subject:
Data Quality Principle. Personal data should be relevant to the
purposes for which they are to be used, and, to the extent
necessary for those purposes, should be accurate, complete and kept
up-to-date.
Purpose Specification Principle. The purposes for which personal
data are collected should be specified not later than at the time
of data collection and the subsequent use limited to the
fulfillment of those purposes or such others as are not
incompatible with those purposes and as are specified on each
occasion of change of purpose.
Use Limitation Principle. Personal data should not be disclosed,
made available or otherwise used for purposes other than those
specified in accordance with Paragraph 9 except: (a) with the
consent of the data subject; or (b) by the authority of law.
Security Safeguards Principle. Personal data should be protected by
reasonable security safeguards against such risks as loss or
unauthorized access, destruction, use, modification or disclosure
of data.
Openness Principle. There should be a general policy of openness
about developments, practices and policies with respect to personal
data. Means should be readily available of establishing the
existence and nature of personal data, and the main purposes of
their use, as well as the identity and usual residence of the data
controller.
Individual Participation Principle. An individual should have the
right: (a) to obtain from a data controller, or otherwise,
confirmation of whether or not the data controller has data
relating to him; (b) to have communicated to him, data relating to
him (i) within a reasonable time; (ii) at a charge, if any, that is
not excessive; (iii) in a reasonable manner; and (iv) in a form
that is readily intelligible to him; (c) to be given reasons if a
request made under subparagraphs (a) and (b) is denied, and to be
able to challenge such denial; and (d) to challenge data relating
to him and, if the challenge is successful, to have the data
erased, rectified, completed or amended.
Accountability Principle. A data controller should be accountable
for complying with measures which give effect to the principles
stated above.
Again, it is clear that such Codes place responsibilities on
those organizations that collect personal information and
establishes rights for individuals. This is the basic premise of
fair information practices.
There is also before the Congress this year legislation based
on a code of fair information practices, The Fair Medical
Information Practices Act of 1994, that sets out privacy protection
for medical records. It is a complex and sophisticated privacy
law, but the underlying structure is similar to most Codes of Fair
Information Practices.
All Codes of fair information practices are based on the basic
principle that organizations that collect and use personal
information have a responsibility to the person about whom the
information refers to, also called the data subject. The
responsibility is sometimes described as a fiduciary obligation,
but it may also be viewed as an expectation to design "safe"
information systems. Like companies that manufacture consumer
products, companies in the information business have a
responsibility to ensure that their products are safe and well
designed. When the product is personal information, safety is
measured in terms of privacy protection.
Over the years, the Codes of Fair Information Practices have
done a fairly good job of clarifying rights and responsibilities,
but there are some shortcomings. Principles lacking enforcement
means create no actual rights when improper uses of personal data
occur. Certain problems, such as the use of a unique identifier
like the Social Security Number are simply not covered by most
codes. And codes do not generally include the goal of encouraging
the use of privacy enhancing technologies such as electronic cash
cards and encryption. These are the possible improvements to
current codes that should have be considered in the development of
a code of fair information practices for the NII.
= = = = = = = = = = = = = = = = = = = =
"The collection of personal data in connection with the
provision of telecommunication services should be limited
to the extent necessary to provide the intended service."
Ministry of Post and Telecommunications,Japan
= = = = = = = = = = = = = = = = = = = =
The Draft Privacy Principles
Viewed against the history of Codes of Information Practices,
the proposed code for the NII is a surprisingly weak set of
standards that does little to protect privacy or even to recognize
some of the emerging privacy issues brought about by network
communications. In shifting responsibility from data collectors to
subjects for basic fair information practices, the principles
weaken current safeguards and make it more likely that the improper
use of personal information will occur. Companies engaged in the
illegal sale of personal information and agencies involved in the
development of surveillance technologies could claim that the
responsibility lies with the individuals not with the organization
to correct these practices.
This is contrary not only to Fair Information Practices but
also to the general structure of privacy law in the United States
which places responsibilities squarely on organization to protect
personal information. For example, the Video Privacy Protection
Act properly places responsibilities on video service providers,
not video store customers, for privacy protection.
The proposed Principles also weaken the notice provision
established in Codes of Fair Information Practices and make it more
difficult for NII users to know fully the privacy implications of
new network services. Most current regulatory approaches encourage
organizations to fully inform customers about product information
so that consumers may make informed decisions. The principles are
silent on such pressing issues as what constitutes "consent" -- the
word is not mentioned in the draft.
The proposed Code also eliminate many of the currently existing
safeguards for data subjects. The proposed Principles of the
Privacy working group require only that Information collectors
inform individuals why information is collected, how it will be
sued, protected, and the consequences for withholding. Missing is
the responsibility to collect only that information necessary for a
transaction.
Individuals who are harmed by the misuse of personal
information may turn to the Redress Principle, but what they will
find is simply the old right to correct inaccurate information
There is no recognition of a legal right to be compensated for
harm.
Viewed against the pre-existing OECD guidelines for the
protection of personal data, the proposed privacy principles will
be considered inadequate by most European countries because the
principles provide insufficient protection for personal data. For
this reason, the ability of users of the NII to exchange
information with users in other countries may ultimately be
jeopardized.
PROPOSED CHANGES FOR THE PRIVACY PRINCIPLES
_______________________________________
The Privacy Working Group would do well to return to the 1973
Code of Fair Information Practices, the 1980 OECD Guidelines, and
then to look at the privacy principles developed in New York State,
Canada, Japan, and the European Community to address communications
technologies. Certain points will become clear.
* The Principles should focus on the responsibility of
organizations that collect personal information
* The privacy implications of new network services should be
made fully known to the public.
* The Principle should set out clear rights for individuals
whose personal information is collected.
* The sale of personal data should require informed consent,
possibly even financial compensation.
* Enforcement of the principles will require legal rights
One model privacy code for the NII is as follows:
1. The confidentiality of electronic communications should be
protected
2. Privacy considerations must be recognized explicitly in the
provision, use and regulation of telecommunications services
3. The collection of personal data for telecommunications
services should be limited to the extent necessary to provide the
service
4. Service providers should not disclose information without the
explicit consent of service users. Service providers should be
required to make known their data collection practices to service
users.
5. Users should not be required to pay for routine privacy
protection. Additional costs for privacy should be imposed only
for extraordinary protection
6. Service providers should be encouraged to explore technical
means to protect privacy.
7. Appropriate security policies should be developed to protect
network communications
8. A mechanism should be established to ensure the observance of
these principles
= = = = = = = = = = = = = = = = = = = =
Proposed Changes to the Draft Principles
* Focus on privacy protection
* Emphasize the responsibility of data collectors
* Add new responsibilities for companies that sell
personal data
* Add a new principle to protect the right of anonymity
* Add a new principle to protect the right to use encryption
* Require affirmative consent for the sale of personal data
* Support the code with legal remedies
* Prohibit the use of universal identifiers
= = = = = = = = = = = = = = = = = = = =
FURTHER INFORMATION
_______________________________________
The Privacy Working Group is requesting comments on the draft
principles. Comments should be sent to the Working Group on
Privacy c/o the NII Secretariat, National Telecommunications and
Information Administration, US Department of Commerce, Room 4892,
Washington, DC 20230. The Principles and Commentary can be
downloaded from the IITF Gopher/Bulletin Board System:
202-501-1920. The IITF Gopher/Bulletin Board can be accessed
through the Internet by pointing your Gopher Client to iitf.doc.gov
or by telnet to iitf.doc.gov and login as gopher. Electronic
comments may be sent to nii@ntia.doc.gov.
Commentators may wish to address the following issues: * The
need to strengthen the proposed principles * The need to establish
an enforcement mechanism for the principles * The need to address
other pressing privacy issues such as Clipper and the FBI Digital
Telephony proposal
BIBLIOGRAPHY
_______________________________________
Bennet, Colin J. Regulating Privacy: Data Protection and
Public Policy in Eastern Europe and the United States. Ithica and
London: Cornell University Press, 1992.
Flaherty, David H. Protecting Privacy in Surveillance
Societies: The Federal Republic of Germany, Sweden, France, Canada
and the United States. Chapel Hill: University of North Carolina
Press, 1989.
Noam, Eli. “Telecomm Privacy Policy Elements.” Transnational
Data and Communications Report .March (1990): 9.
Rotenberg, Marc. “Privacy and the National Information
Infrastructure.” Educom Review 29.2 (1994): 50-51.
Rotenberg, Marc. “Communications Privacy: Implications for
Network Design.” Communications of the ACM 36.8 (1993): 61-68.
U.S. Department of Health, Education, and Welfare (HEW),.
Records, Computers, and the Rights of Citizens. Washington, DC:
HEW, 1973.
ABOUT EPIC
_______________________________________
The Electronic Privacy Information Center is a public interest
research center in Washington, DC. It was established in 1994 to
focus public attention on emerging privacy issues relating to the
National Information Infrastructure, such as the Clipper Chip, the
Digital Telephony proposal, medical record privacy, and the sale of
consumer data. EPIC is sponsored by the Fund for Constitutional
Government and Computer Professionals for Social Responsibility.
EPIC publishes the EPIC Alert and EPIC Reports, pursues Freedom of
Information Act litigation, and conducts policy research on
emerging privacy issues.
EPIC Alert is a biweekly publication that provides information
on recent privacy developments, including legislation, reports, and
upcoming conferences. To subscribe to the EPIC Alert, send the
message: "subscribe cpsr-announce " (without quotes or
brackets) to listserv@cpsr.org. You may also receive the Alert by
reading the USENET newsgroup comp.org.cpsr.announce
EPIC Reports provide detailed analysis of emerging privacy
issues, and are distributed free of charge to Internet users.
Future reports will focus on national identification cards,
electronic surveillance, medical record privacy, Clipper chip and a
US privacy commission. Comments and suggestions are welcome. Send
messages to reports@epic.org.
=====================================================================
Electronic Privacy Information Center (EPIC)
666 Pennsylvania Ave., SE Suite 301
Washington, DC 20003
+1 202 544 9240 (tel) +1 202 547 5482 (fax)
info@epic.org
=====================================================================